
The perfect unprotected system is gone: The Blue Playstation 


Hi! I'll take you to the perfect art of copying a disc made for the Sony 
Playstation. Since the first week the Playstation (formerly known as PSX) 
came out, Sony didn't give us a second breath. At the very beginning of the 
story, the PSX was a perfect unprotected system. If you tried to copy a 
disc for it, it worked perfectly like 

it was an original CD-Rom. These first consoles were delivered only to Game 
Magazine reveiwers, big games retailers and mainly the unit was not for us, 
the public, the gamers! This PSX is called Blue PSX and it's rare like the 
platinum box in AD&D. Then Sony released it's jewel in the form that we all 
now know and love. 

But this unit was no longer blue, instead it's blue-gray and mainly hides a 
protection system! Every good pirate who already knew the way to play on 
the SNES wondered if the PSX would have been a good toy to take. 
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• The tools you need to copy on the Macintosh: Toast and CD-Copy 

Of coarse it was, but a copied CD didn't boot and something weird was going 
on. The public PSX can check if a CD is copied or original. So people 
wondered why a copied CD didn't work like an original one and asked each 
other wether it was possible to use a copied CD. All of these problems are 
now gone and, excluding some strange behavior in some games, all the PSX 
games can be copied 

and played without any problems on every console, you just need to know 
some rules. The first thing you need is a Macintosh. You also need the two 
software tools for copying CD's, Toast CD-Rom Pro and CD-Copy. As I'm 
writing this column in July, Toast is at version 3.0.1 and CD-Copy is at 
1.02e. You should get them if you want to have the same dialog windows I'm 
showing. Let's imagine you go to your local Blockbuster and 
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Other tools you need: a CD-Rom drive, and plenty of HD space 


see Tekken II to rent. Ok, rent itl Before starting copying it, there are some 
things you need to know. Since we are going to use CD-Copy first, let's 
start with it. To use CD-Copy you need an Apple Driver compatible CD-Rom 
drive or CD-R drive. Depending on the speed of the reader, it will take less 
time to copy the game. Using CD-Copy, we create an image of the ISO track 
of the game into a file on our hard disk and, if present, we also grab all the 
game audio tracks into single DA compatible format files onto our hard 
disk. All these files together are a PSX game. So, if you're going to copy 
Tekken II, be sure you've got 600 megabytes free on yuor hard disk, since 
CD-Copy will fill it up. If you're going to use an Apple Driver compatible 
reader, just be sure you've your extensions loaded so that you can access 
the CD-Rom. 
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• The CD-Copy: Please insert disk... 

If you plan to use a CD-R to read the original CD, you need to load a CD-R 
driver before using it. To use a CD-R as a reader, you can run Toast 
CD-Rom Pro, insert the original CD in to the CD-R and type open-apple-M to 
mount it on the desktop. Once the CD is on the desktop, either using a 
CD-Rom drive or a CD-R drive, run CD-Copy. It will automatically start 
scanning the PSX CD and will find, in the case of Tekken II, one ROM track 
(ISO) and two audio tracks. According to a bit mark used to mark if an 
audio track is copy protected or not, you might read Track 1, Track 2 for 
the audio tracks names if this bit is not set (not Tekken case) or Audio 
Copy Prohibited if this bit is set. We don't care about it; unless you want to 
be a good guy, an audio track can be copied without any problem even if this 
bit is set and you read that weird track name. Anyway, it's time to grab 
everything, ROM track and audio tracks. 
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CD-Copy: Preferances to set 


There are some preferances we have to set in CD-Copy before we start 
grabbing multi-track discs. Select Audio Track Options, the only checkbox 
that should be on is the "Read Q-Codes" option, all the rest should be off. 
Also select Data Track Options, all the checkboxes should be off and XA 
Sector Format should read "full(header+subheader+data)\ The Ignore Read 
Errors (in preferances) option is usually disabled and helps us determine if 
a CD is damaged or dirty. Fingerprints on the surface of the CD can often 
cause this problem, affecting the laser. Sometimes, if a read error is 
encountered the copying process may abort and the data discarded. If you 
start grabbing a CD and you encounter many read errors (the CD-Copy log 
window shows a message "slow down reading..." process), it might help if 
you try and clean the CD. There was an old method of cleaning CD's with 
toothpaste which still works. I usually use neutre soap instead. Once all of 
the preferences are ready (and they'll be saved for the next time) let's 
click on SAVE AS... A dialog will ask where you want to save the file(s). 



Expose- PSX Game Copying 


Page 8 


Thu, 11 Mar 1999 





v - v 


• The CD-Copy: Save As and Read Errors 

Save them where there Is enough room and select "multiple files", not as a 
single file (even if we tried, note that we would not be able to save as a 
single file a ROM track with audio tracks). CD-Copy will fill up all the needed 
space imeddiatly, so if you don't have enough space, you'll be immediatly 
warned. Also, the audio tracks will be appended with a progressive integer 
number, so we'll be able to detect the order even if some friend of ours will 
come and mess up the Veiws settings. The copying process will take some 
time. However there will be no more need for computer interaction until the 
copying is complete. The copying process may be disturbed by a random 
system beep. That's not abnormal, but it means that there is a read error. 
This may be due to a dirty disk that we spoke of earlier. Try and clean the 
disk. If that fails the disk may be damaged. 
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• The CD-Copy files: What you get on the hard disk 

It's unusual for a CD but my Ridge Racer original CD got damaged and I can't 
read it anymore: God blessed i had already made a copy. If everything goes 
well, we will find our tracks saved onto our hard disk. We can quit CD-Copy 
since we do not need it anymore. Depending on which Toast version we have 
installed, we'll see a different icon for the ROM image. The icon is important 
to check if everything is okay with the image. We must find an icon which 
reports a 2352 number on it or the icon with a little flag with ISO written on 
it. Once we found the files, drag and drop them onto toast 3 and it will 
automatically detect their type and will create an ISO XA CD-ROM, ready to 
be written. WARNING: if you let CD-COPY create the CDDA Track file, doing 
the drap and drop causes Toast to build an incorrect CD. 
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• Toast CD Rom Pro 3: Drag and drop and create the CD 

Do not drag and drop the CDDA file. Now, start writing the CD. If you do not 
want to use the drag and drop, just open toast 3, select the disc image file 
and open the ROM image file we created (the one with the ISO flag on the 
icon) and then the Audio Tracks option all the DA tracks we grabbed using 
CD-Copy in the order CD-Copy created (from 1 to the highest number). You 
have just succesfully copied your first PSX CD. Well, now we put it into the 
PSX, power it up and play it. Right? Yes, because this is what we do with the 
original disc(s) we have, but if we try to do this with a copied disc, unless 
you patched your PSX with one of the hacked chips you can get, the game 
won't start, and depending on the console model you own, you'll get some 
sort of check-disc icon. 
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* Boot the PSX: The Audio Menu Trick 

This is the protection I told you about at the very beginning of the expose. 
But do not dispare: we all copy the discs like I just told you, so there must 
be a trick to make the game boot. The is more than one way to get the 
game to boot. The safest and oldest is called the audio menu trick and 
here's how it works. Power up your PSX without any CD inserted. Go to the 
audio menu and insert an original CD for example the Demo CD. Now, if you 
close the cover, the Playstation will read the CD, but once read we need to 
take it out again but this time we need to make the console think the CD is 
still inserted. You need a stick, a mechanic stuff, a flexable and 
compressable stuff to put onto the close button and stays at the bottom 
of the disc bay, next to the right back of the circle. 
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♦ Boot the PSX: The Audio Menu Trick and the lid button 

There is a little button that once pushed makes the PSX think that the 
cover is closed and it spins the CD to read it. So when you inserted the 
original disc, do not close the cover, but instead block the button, pushing it 
with a stick which may be embedded in the button, so that the CD starts 
spinning as if the cover is closed. Once the original CD has been read, you 
will see the Audio tracks number appear on the audio menu. For each track 
of the CD, there will be a relative number in the Audio Menu window. Note 
that if a game is in the playstation, the first track is a ROM track and 
cannot be played (it does not sound at all). Now, take out the the original 
disc and insert the copied game you wish to play (our Tekken II for 
example). "Click" on the exit button. Since the Playstation thinks there is an 
original game disc inserted it will boot it. This is the Audio Menu trick the 
first one invented. 
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Playing a multidisc game: Trick to switch discs 


What happens if the game is more than one disc? The Playstation will wait 
for you to insert the second disc (for example Novastorm). If you take your 
second copied CD and put it into the disc bay and continue, the PSX will ask 
you for the second CD again since it recognises that the disc is not original. 
You have to insert your original CD instead, the Demo CD for example, and 
tell the PSX to go on. It'll read the disc and find that it's the wrong one and 
will again ask you to insert the second disc. No problem, put in your second 
copied disc into the drive bay WITHOUT OPENING THE PUSH BUTTON and 
make the PSX go on. Since the PSX remembers the original CD (the Demo 
CD) inserted previously, it will think the second copied CD is original. This 
trick currently works with all multi disc games I know of. 
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• PSX Playstation: The bad CRC and the black CD 

Yoy may wonder why we have to do all this disc swapping, button pushing 
etc. Well, this is due to the protection. The protection the PSX uses is 
basically elemental An original disc is black in colour and the copied ones 
are not. The lens checks this out so gold or white discs will not work. Just 
kidding! The fact is that the original CD is black purely for commercial 
image: as you get in your hand a black CD, you can say it's 100% original. 

On the otherhand, if you get a non-black cd (gold, or white if made in Hong 
Kong) it's 100% illegal. The protection (see notes) is much more technical. 
The 15th sector of the original disc has a bad CRC. This is where the PSX 
goes to check. We would need a RAW copy for this, but nobody in the known 
world ever wanted to resolve this problem and so they used a chip! 
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PSX Unprotection: The CHIP way 


One day, Aliens came from Venus their 3 million kilometers per second 
spaceships and travelling near the moon they lost a box full of strange 
chips. People of Hong Kong and Japan took a shuttle and went to take this 
box, knowing it could help humanity. And it did. It contained the very first 
ROM chips the playstation used. Remember, the Blue PSX I was talking about 
at the start of this Expose? Yeah, well aliens took it and used it's BIOS 
(ROM) for all the public models. So now we can boot copied discs as if they 
were originals; we can buy a PSX in Japan and a game in Europe and it will 
work (it does not normally, if not using the audio menu trick!). The chip 
needs some cold saldature in 8 or 9 pins of the PSX motherboard. It's very 
easy, but there is not only one model. There is one for each type of 
Playstation (Europe, US) so be sure you have the right one. 
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• PSX Protection: The new console models 

There is still some bad news to tell you. Some Playstation does not accept 
the audio menu trick or any new swap tricks because the ROM is an 
advanced model and can keep on checking the bad CRC. There consoles 
were being sold the world over since November 1995 and so, alot of people 
might bump into this newer model. You will recognise one of these consoles 
by it's serial number which is 595xxxxx onwards. In this case the chip is the 
only possible solution. The other bad news is that some very old models 
perform very badly with the chip inserted, especially Japanese models. The 
audio is badly played and the console may freeze due to the high 
temperature the components reach. Consider also that you can have the 
chip removed easily since it's soldered on cold contacts, so you can try to 
use the chip and remove it if it gives you problems. 
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PSX Protection: One day, games might be uncopiable 





More bad news that I have to tell you about is the fact that Sony will soon 
make new modifications to the motherboard. This was anounced before this 
was written. So the chip method will be obsolete on new models soon. Keep 
a look out on the net for the latest news. Also, despite all the methods 
mentioned in this expose, some games are still uncopiable. Uncopiable is not 
a word in a good hackers dictionary. In other words, the games behave very 
badly when being copied, the disc may not show up on the Desktop, and even 
if it does sometimes it will not copy. Namco Museums 3 is one game that 
suffers from this. However, a game that does not start using the Audio 
Menu trick may run using other methods. 

C. 
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• Boot the PSX: The limitations of the Audio Menu Trick 


♦ Boot the PSX: The Audio Problems 


First of all, these alternatives will only work on machines where the Audio 
Menu Trick can be used. That means 595xxxxx and above cannot use the 
following methods. There are other tricks besides the Audio Menu Trick 
which is the easiest. There are other methods of swapping your copied 
discs and getting them to run. 

These alternative methods were used to get the audio to work properly. 
Using the Audio Menu Trick, the Playstation keeps the Digital Audio Track 
table from the original CD, the one you used to make the Playstation think 
there was an original CD in the drive. The Audio Track table is not the same 
as that of the copied game. The Audio table contains a list of the individual 
tracks, along with the start points, end points , pre-gap, post-gap, absolute 
position on the disc etc. 



Consider games like Mortal Kombat III. It has so many audio tracks that 
there was no original CD to use to have an audio table to cover all the 
Mortal Kombat requests, so when the game asked for track 70 to be 
reproduced the Playstation gave an error and the game stopped. The demo 
CD has only 6 audio tracks and games like Ridge Racer or Battle Arena 
Toshinden (the first one I got, because it was the only one available whm 
the PSX came out) have 15 tracks maximum. Alot of games go over that 
number of Audio tracks. Also, even if a game can work with a different 
Audio Table in memory, the audio tracks of the copied game are usually 
interrupted, not from the beginning point, and they last a different time 
(the time memorized in the table of the original CD), so sometimes the 
game screws up. 
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• Boot the PSX: The Perfect Swapping trick 


Due to the imperfection of the Audio Menu Trick, there are some other 
methods that you can use. The best one (also the hardest) lets you load a 
disc with it's own Audio Table and is the best to use if your losing alot of 
audio using the first trick. Consider that the Playstation takes 3 seconds 
to read the Audio Table. The first 2 are used to spin the disk and check if 
there is a ROM track and if there is a bad CRC (the protection). Then it 
starts to read the Audio Table. So, if we act at the right moment, 
perfection shall be reached. So, power up your playstation without any disc 
inserted, go to the audio menu and insert an original disc. Let it spin (block 
the close switch with a stick so that the playstation thinks the cover is 
closed, when in fact it's open) and count 3 seconds as soon as the CD 
starts spinning. 
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Boot the PSX: The Perfect Swapping Trick (2) 


A perfect way to be sure you're at the third second is to think the 
foloowing sequence " 1 1000 2 2000 3 3000". As soon as you have thought 
of “three thousand", take out the spinning disc on the fly (yes, it's spinning, 
be sure to read the following note) and insert your copied game. If the 
timing is right, the CD will be read after 2 seconds more and you'll see 
appearing the number of tracks of the game you actually want to play. 
Usually you are used to seeing the number of tracks of the original Demo 
CD, using the Audio Menu trick. This time you see the number of tracks of 
your copied CD. Just remember the number of tracks of your boot disk and 
if it comes up with that amount then you haven't done it correctly. Press 
the reset button and try again. Note: A rotating disc must be removed 
immediatly, be sure not to use force. 
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• Boot the PSX: The Perfect Swapping Trick (3) 

or stop the rotating mechanism of the Playstation. You must remove the 
disc as fast as possible so that you do not damage the motor. Put in the 
copied game as quickly as possible. The Playstation engineers never 
designed the motor to take such a beating, so be careful. Not let's 
continue. Remove the game you want to play and insert the original CD 
again and leave the CD Audio Menu. The boot disk will begin to spin again. 
You will see the black screen come up, with the Playstation logo fading in. A 
soon as it's completely faded in, take out the boot disc and place your 
copied game back in the Playstation. This short time is the only period that 
the Playstation stops reading the disc and we do the swap. This method is 
great for solving audio problems. 
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Boot the PSX: The Fastest Swapping Trick 


There is a last method used. Just boot with an original CD, wait for the 
Playstation logo (note, that this refers to the logo picture in the European 
version) to come on the black screen and do the on the fly swap. This is the 
fastest trick and runs some games that fail to run using the Audio Menu 
Trick (Road Rash). 
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• PSX Playstation: The World Situation 

Okay, there is nothing more you need to know to play with a Playstation. 

The World situation is at a point where people with the new console model, 
use the chip and get a blue Playstation. People who are lucky and have the 
first models can use all the tricks I just explained but could put a chip in 
their console also. Now Sony is going to make some changes, but they will 
always be a chip available, Actually, new mechanical prevention methods are 
being used by Sony to avoid disc swapping. The latest PSX models detect if 
a CD is removed by 3 little silver coloured pins located at the center of the 
CD unit. These are use to keep the CD in place when spinning and to detect 
if a CD has been removed (this is actually what the previous models already 
did, but the new models also make the Playstation reboot, not only stop like 
before). 
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• PSX Protection: The very last model out 

The only thing you have to do if you want to run copies on the latest PSX is 
to mount two wires parallel over the connector (which leads to the 3-pin 
detector) and put a switch between the two wires so that the Playstation 
will never see if a CD is removed or not. Once this is done, you can use all 
the tricks already explained. You will in fact get a very first PSX model. 
There is nothing more to tell you know. In fact, this is all we wanted to 
know from the inside of this Ezine. Stay tuned for new issues and updates. 
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• Notes: Copy Protection 

The PSX compact disc copy protection is based on the premise that most 
(if not all) CDR's and pressing stations pre-mastering prosesses will 
automatically regenerate a 'corrupt' sectors EDC/ECC code. 

Sectors 12 through 15 contain zeroised EDC/ECC checksum (impossible) so 
if a PSX reads and doesn't see an invalid EDC/ECC then it knows that the CD 
in the drive is a copy, (The EDC is simply a CRC type hash that is used as a 
checksum to determine if a sector was read correctly. The ECC is used to 
recreate the sectors data). 
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• Notes: Serial Numbers and Models 


On the back side of the Playstation, you will find a label with the model type 
and the serial number in the form: ACCCCCCCC, with A = letter and X = 
number. A serial number which is 595xxxxx onwards means you have a 
protected model. 

As for the model types: The Japanese units are SCHP-1000. There are a 
number of different builds of these units, all with the SCHP-1000 model 
number but depending on the date of manufacture they may have different 
ROM BIOS versions. The basic difference in the ROM BIOS is that the earlier 
units did not have a country code check (as it was not finalised) and 
therefore will allow you to use the 'swap method' to boot non-Japanes 
games, while newer units will not (as is the same with Euro/US machines). 
The development units are SCHP-2000 and are identical to the base-build 
SCHP-1000, except their ROM BIOS has both the country and CD based 
protection disabled and are a deep blue colour instead of the typical grey 
(the BLUE Playstation!). 

The USA Playstations are designated SCHP-3000, These are basically a 
cheaper build of the SCHP-1000, using 70ns RAM (instead of 60NS) and do 
not have an inbuilt SVHS port. They also have a country code check in theit 
ROM BIOS (as with the later revision Japanese SCHP-1000's), The 
Austrailian on in general PAL (Italian too) Playstations are designated 
SCHP-1002. 
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